5.8. Incident Response

💡 First Principle: When a breach happens at 2 AM, chaos is the default without a plan. Incident response is the organized approach to handling security breaches. When prevention fails — and it will — the speed and effectiveness of your response determines whether the incident is a minor disruption or a catastrophic breach. An organization with a practiced incident response plan can contain a breach in hours; one without a plan may take months to even detect it.

What happens without incident response? The 2013 Target breach went undetected for weeks, compromising 40 million credit cards. Analysts actually received alerts from their monitoring tools — but without a clear escalation process, the alerts were ignored. Incident response isn't just having the right tools; it's having the right processes, trained people, and practiced procedures so that when alerts fire, people know exactly what to do.

Unlike other security domains (which try to prevent incidents), IR accepts that incidents will occur and focuses on minimizing impact. It's the difference between trying to never have a car accident and knowing how to respond when one happens — both are important, but only one matters when you're standing at the crash site.